ClawHub
Back to skill

Security audit

Skill Combinator — Emergent Capabilities Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent purpose, but it should be reviewed because it automatically reads agent/workspace context, keeps persistent history, and sends scheduled Telegram reports.

Install only if you are comfortable with a recurring job that inventories skills, reads agent context files, writes long-lived combination history, and sends operational summaries to Telegram. Prefer pinning the installer version, limiting or removing MEMORY.md access, reviewing COMBINATIONS.md and .learnings regularly, and keeping Telegram reports free of sensitive project details.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:23
Finding

Excessive Read Access to Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-35; duplicated in cron-message.md:68-75
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: Low

Vulnerable Configuration

yaml
paths:
  read:
    - /workspace/skills/
    - /workspace/MEMORY.md
    - /workspace/AGENTS.md
    - /workspace/.learnings/LEARNINGS.md
    - /workspace/.learnings/FEATURE_REQUESTS.md
    - /workspace/COMBINATIONS.md
  write:
    - /workspace/COMBINATIONS.md
    - /workspace/.learnings/LEARNINGS.md
    - /workspace/.learnings/FEATURE_REQUESTS.md
    - /workspace/memory/YYYY-MM-DD.md

The corresponding weekly task explicitly authorizes these commands:

text
READ — inventory and learnings:
- ls /workspace/skills/
- cat /workspace/skills/*/SKILL.md | grep -E "^name:|^description:"
- cat /workspace/.learnings/LEARNINGS.md
- cat /workspace/.learnings/FEATURE_REQUESTS.md
- cat /workspace/COMBINATIONS.md
- cat /workspace/MEMORY.md
- cat /workspace/AGENTS.md

Technical Analysis

The skill requests permission to read /workspace/MEMORY.md, although the documented weekly-distillation algorithm does not require persistent general memory. Its stated inputs are the installed-skill metadata, combination logs, feature requests, the combinations catalogue, and the autonomy policy.

Persistent memory may contain private historical context, prior task information, or operational details unrelated to skill-combination analysis. Loading that information into the model context unnecessarily expands the data exposed to the skill and violates least-privilege principles.

Reading AGENTS.md has a documented purpose—consulting the autonomy gate and proposing startup-ritual changes—but granting access to the complete file is still broader than a dedicated, narrowly scoped policy interface would be.

The project includes instructions not to log or output sensitive data, which reduces the likelihood of disclosure. However, instruction-leve ...[truncated 1276 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove /workspace/MEMORY.md from the declared read paths and from the cron task because the documented distillation process does not use it.
  2. Replace full AGENTS.md access with a dedicated file containing only the autonomy-gate policy required by this skill.
  3. If full AGENTS.md access is unavoidable, extract only a clearly delimited policy section rather than loading the complete file.
  4. Enforce file permissions through the OpenClaw runtime instead of relying solely on natural-language constraints.
  5. Add an output-filtering step that detects secrets and personal information before reports or memory summaries are written.
  6. Document each requested file permission and the exact processing operation that requires it.

T08 · Insecure Dependencies

Warning
Location
README.md:74
Finding

Mutable Remote Package Executed Through an Unpinned Installation Command

Content
View full analysis

Vulnerability Details

File Location: README.md:74-78; repeated in CONFIGURATION.md:50-54
Vulnerability Type: Unpinned third-party installer and mutable supply-chain dependency
Risk Level: Medium

Vulnerable Instructions

markdown
## Installation

```bash
npx clawhub@latest install skill-combinator
text

The same command appears in `CONFIGURATION.md`:

```bash
npx clawhub@latest install skill-combinator

Technical Analysis

The documented installation procedure invokes npx with the mutable @latest tag. This causes the operator to retrieve and execute the version of the clawhub package associated with that tag at installation time, rather than a specific version whose contents correspond to the audited project.

Consequently, the effective installer can change after this audit without any modification to the repository. The instructions provide no exact package version, integrity hash, lockfile, signature-verification procedure, or provenance check.

This is a supply-chain risk rather than evidence that the current clawhub package is malicious. Exploitation would require compromise of the upstream package, its publisher account, the registry distribution path, or a future malicious release assigned to latest.

Attack Path

  1. An attacker compromises the upstream package publisher, package registry entry, or release process.
  2. The attacker publishes a malicious clawhub version and causes the latest tag to resolve to it.
  3. An operator follows the project documentation and runs:
    bash
    npx clawhub@latest install skill-combinator
  4. npx downloads and executes the attacker-controlled package version.
  5. The malicious installer executes with the permissions of the account or container running the installation command.
  6. It may alter workspace files, steal accessible credentials, install modified skills, or perform other actions available to that execution context.

Impact Assessment

Successf ...[truncated 673 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, audited package version:
    bash
    npx clawhub@<exact-version> install skill-combinator
  2. Publish and verify the expected package integrity hash before execution.
  3. Provide package-signature or provenance-verification instructions, such as registry attestations or signed release artifacts.
  4. Review the resolved package metadata and source before running the installer.
  5. Execute installation in a restricted container or account with no access to unrelated credentials or host resources.
  6. Disable package lifecycle scripts where supported and not required.
  7. Update both README.md and CONFIGURATION.md together so all installation instructions use the same pinned, verified release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Requiring a TELEGRAM_BOT_TOKEN and weekly reports implies outbound transmission to Telegram, but the README does not clearly warn that operational discoveries or summaries may leave the local environment. In this skill's context, weekly synthesis of cross-skill activity could package sensitive internal information and exfiltrate it to a third-party service if users are not fully informed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims it will 'automatically detect' complex missions and trigger itself whenever multiple domains are involved, but the trigger conditions are vague and expansive. In a meta-skill designed to combine other installed skills, this ambiguity can cause overbroad invocation, unintended chaining of capabilities, and reduced operator control over risky cross-skill behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill says to run on 'any complex mission' without defining scope, exclusions, or approval boundaries. In an agentic system, broad activation criteria can cause unnecessary triggering on sensitive tasks, expanding access to other installed skills and increasing the chance of unintended actions or data aggregation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes persistent creation and growth of COMBINATIONS.md and .learnings/* over time, but does not clearly warn about retention, sensitivity, or review of stored content. This can lead to silent accumulation of task history, operational patterns, or sensitive project details in local files that future runs may reuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill's activation criteria are intentionally expansive ('whenever your agent faces a complex multi-domain mission, receives a new project, or when 2+ skills could interact'), which can cause it to run on many ordinary tasks and repeatedly inspect broad workspace state. In a meta-skill with read access to multiple memory and coordination files plus write access to persistent logs, over-triggering increases the chance of unnecessary data exposure, excessive autonomous planning, and unintended side effects from routine use.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CONFIGURATION.md (reported line 194)May include surrounding context.

md
6. Send a structured weekly report to the operator

Non-negotiables:
- You MUST read your skill first: /workspace/skills/skill-combinator/SKILL.md
- NEVER fabricate combination results — log UNKNOWN if outcome unclear
- NEVER install a new skill autonomously — only PROPOSE to operator
- NEVER modify SOUL.md under any circumstance

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · cron-message.md (reported line 43)May include surrounding context.

md
6. Send a structured weekly report to the operator

Non-negotiables:
- You MUST read your skill first: /workspace/skills/skill-combinator/SKILL.md
- NEVER fabricate combination results — log UNKNOWN if outcome unclear
- NEVER install a new skill autonomously — only PROPOSE to operator
- NEVER modify SOUL.md under any circumstance

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · cron-message.md (reported line 61)May include surrounding context.

md
6. Send a structured weekly report to the operator

Non-negotiables:
- You MUST read your skill first: /workspace/skills/skill-combinator/SKILL.md
- NEVER fabricate combination results — log UNKNOWN if outcome unclear
- NEVER install a new skill autonomously — only PROPOSE to operator
- NEVER modify SOUL.md under any circumstance

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The cron task explicitly authorizes outbound report delivery using credentials from environment variables, creating an external data egress path that is broader than a local combinations-distillation function requires. Even though the prompt says not to send secrets, the task aggregates workspace-derived information and sends it off-box automatically on a schedule, which increases the chance of unintended disclosure if the report content or downstream channel is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs network-based report delivery using environment-backed credentials but does not provide a user-facing warning or consent step about scheduled data transmission. In context, this is more dangerous because the job is recurring and isolated, so exfiltration can happen automatically and repeatedly without immediate operator review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The task reads broad agent state files such as MEMORY.md and AGENTS.md that are not strictly necessary for promoting proven skill combinations from learnings data. This expands the accessible context and can expose unrelated operational or sensitive information to the scheduled job, especially when combined with later reporting and logging steps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.